[go: up one dir, main page]

US20100071063A1 - System for automatic detection of spyware - Google Patents

System for automatic detection of spyware Download PDF

Info

Publication number
US20100071063A1
US20100071063A1 US12/515,843 US51584307A US2010071063A1 US 20100071063 A1 US20100071063 A1 US 20100071063A1 US 51584307 A US51584307 A US 51584307A US 2010071063 A1 US2010071063 A1 US 2010071063A1
Authority
US
United States
Prior art keywords
computer
output packets
user inputs
differences
spyware
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US12/515,843
Other languages
English (en)
Inventor
Hao Wang
Somesh Jha
Vinod Ganapathy
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Wisconsin Alumni Research Foundation
Original Assignee
Wisconsin Alumni Research Foundation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Wisconsin Alumni Research Foundation filed Critical Wisconsin Alumni Research Foundation
Priority to US12/515,843 priority Critical patent/US20100071063A1/en
Assigned to WISCONSIN ALUMNI RESEARCH FOUNDATION reassignment WISCONSIN ALUMNI RESEARCH FOUNDATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: JHA, SOMESH, GANAPATHY, VINOD, WANG, HAO
Assigned to ENERGY, UNITED STATES DEPARTMENT OF reassignment ENERGY, UNITED STATES DEPARTMENT OF CONFIRMATORY LICENSE (SEE DOCUMENT FOR DETAILS). Assignors: WISCONSIN ALUMNI RESEARCH FOUNDATION
Publication of US20100071063A1 publication Critical patent/US20100071063A1/en
Assigned to NAVY, SECRETARY OF THE UNITED STATES OF AMERICA reassignment NAVY, SECRETARY OF THE UNITED STATES OF AMERICA CONFIRMATORY LICENSE (SEE DOCUMENT FOR DETAILS). Assignors: WISCONSIN ALUMNI RESEARCH FOUNCATION
Assigned to NAVY, SECRETARY OF THE UNITED STATES OF AMERICA reassignment NAVY, SECRETARY OF THE UNITED STATES OF AMERICA CONFIRMATORY LICENSE (SEE DOCUMENT FOR DETAILS). Assignors: WINCONSIN ALUMNI RESEARCH FOUNDATION
Abandoned legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/564—Static detection by virus signature recognition
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL

Definitions

  • the present invention relates to systems for combating spyware on computers and in particular to a system that may automatically detect and generate signatures for unknown spyware.
  • Spyware are programs that run on computers without the knowledge or permission of a user and which steal sensitive or private information from the user and forward that information to a remote site.
  • Examples of spyware are keyloggers which capture a user's keystrokes, tracking software which monitor the user's destination on the web, screen scrapers which pull data from the user's display screen, and Trojans which download and install other spyware.
  • Some spyware masquerades as benign computer programs intended to provide useful functionality, such as browser plug-ins and extensions.
  • the stolen information obtained by spyware can be used for criminal activity, for example, if financial information or passwords are stolen.
  • spyware is used to target unwanted advertising to the user, triggered for example, by the user's browsing activity.
  • spyware is intended to remain hidden on the computer. This very characteristic makes it difficult to detect spyware; a recent study has reported that as many as 80% of computers are spyware infected.
  • the present invention automatically detects both known and unknown spyware by monitoring deviations from normal network activity when a computer is subjected to a set of test “user” inputs.
  • New outgoing network packets that carry information about the user (for example information from the test user inputs) and/or that provide information to an unknown remote server, are a strong indication of a spyware infection. When spyware is discovered, a warning may be provided to the user.
  • the outgoing network packets produced by the spyware identified by this process, may be used to simply and automatically generate signatures of the spyware for use by other computers.
  • the present invention provides a method of detecting spyware comprising the steps of identifying a set of standard output packets generated by a “clean” computer in response to a given set of user inputs. These same user inputs are then applied to an “unknown” computer and differences between the standard output packets and the output packets of the “unknown” computer are identified. Based on these differences, likelihood that the unknown computer is infected with spyware is assessed.
  • the invention may determine whether the differences in output packets include output packets addressed to an unknown server.
  • the invention may determine whether the differences in output packets include output packets that have data correlated with the given set of user inputs.
  • the invention may assess a threat level based on both whether the output packets from the unknown computer include addresses of an unknown server and whether the data is correlated with the given set of user inputs.
  • the user inputs may be automatically generated and input to the computer by a program running on the computer.
  • the given set of user inputs may be selected from a set of common server addresses.
  • the given set of user inputs may be selected in part by analyzing executable programs on the computer for web addresses.
  • the “clean” computer having a known clean state and the “unknown” computer having an unknown state may be implemented as different computer hardware, or may be the same computer hardware executing the same program at different times, or the same computer hardware executing two independent instances of a program.
  • a “clean” and “unknown” computer may be implemented as two browser programs executing on the same computer hardware, where one browser is a standard browser, susceptible to spyware, and the other browser is configured not to accept browser plug ins.
  • the standard user inputs may be any inputs by the actual user.
  • the standard user inputs may be developed on different computer hardware initialized with the same software as the “unknown” computer and having a known clean state.
  • the invention may further include the step of extracting a signature from the differences between the standard output packets and the output packets of the “unknown” computer and providing signatures to a monitoring program.
  • the signature may be a longest common subsequence of the differences.
  • the steps of the invention may be repeated periodically, or may be repeated upon a loading of new programs into the computer of unknown state.
  • FIG. 1 is a schematic representation of a network of different computers showing three embodiments of the present invention
  • FIG. 2 is a detailed block diagram of one computer of FIG. 1 showing data flow between an operating system of the computer, spyware programs or programs that may be spyware infected, and the spyware detection program of the present invention;
  • FIG. 3 is a detailed block diagram of the spyware detection program of FIG. 2 showing the tasks of collecting and analyzing standard network outputs and modified networked outputs such as may be performed on one or more of the computers of FIGS. 1 and 2 ;
  • FIG. 4 is a figure similar to that of FIG. 2 showing implementation of the present invention in a program that may be susceptible to spyware infection;
  • FIG. 5 is a block diagram of a browser showing an embodiment of the invention providing improved identification of user-sourced information used to identify spyware generated output packets;
  • FIG. 6 is a block diagram depicting a scanning process used to find server addresses that may evoke spyware behavior.
  • a network 10 may include, for example, an edge router 12 connected to the Internet 14 or the like by a network line 16 and communicating with multiple local network connections 18 with computers 20 a - 20 d.
  • the network 10 may further include a network intrusion detection system (NIDS) 22 attached to the network line 16 to monitor network traffic to detect malware, including spyware viruses and the like.
  • NIDS 22 may hold a number of signatures 24 of different types of malware including viruses and spyware and the like and may, for example, be a computer running a program such as “Snort”, an open source intrusion detection/prevention system available at http://www.snort.org, or “Bro”, an intrusion detection system available at http://bro-ids.org.
  • the present invention may be implemented by programs 26 running on one or more of the computers 20 a - 20 d.
  • the program 26 runs on a single computer 20 d to detect spyware infecting the computer 20 d and to provide corresponding signatures 24 by a signature transfer path 28 to the NIDS 22 .
  • the program 26 may alternatively or in addition notify the operator of the computer 20 d of the presence of spyware via warning signal 68 , for example transmitted to a local or remote monitoring terminal 29 .
  • the program 26 runs on computers 20 b and 20 c.
  • the computer 20 c provides data about normal computer operation (to be described below) via connection 30 to computer 20 b used by that computer 20 b in the detection of spyware on computer 20 b and/or the generation of signatures or warning signals.
  • the program 26 operates solely on computer 20 a and provides two instances of a program, such as a browser, one instance providing data about normal computer operation, and one instance susceptible to spyware infection and under continual supervision.
  • a program such as a browser
  • the outputs of the program instances are compared to detect spyware.
  • a computer 20 of FIG. 1 may execute an operating system 32 such as the Windows XP operating system commercially available from the Microsoft Company of Redmond, Wash.
  • the operating system 32 provides a user input interface 34 , for example, implemented by an application programmer interface (API) understood in the art that may receive user inputs 36 from a user by means of a user interface device 38 such as a keyboard, mouse or other input device well-known in the art.
  • API application programmer interface
  • User inputs 36 need not be from a user of the computer 20 , but are simply inputs received, for example, from user input interface 34 and treated by application programs as actual inputs from users would be treated.
  • the operating system 32 may also provide for an Internet interface 40 to network connections 18 or the like also by means of an API.
  • the interfaces 34 and 40 provide a simple mechanism for application programs 42 to communicate with external hardware and devices.
  • the application programs 42 may be a browser 44 such as the Internet Explorer browser manufactured by Microsoft.
  • Such a browser 44 may permit one or more plug-ins 46 to enhance or customize the operation of the browser 44 and may also harbor spyware.
  • the program 26 of the present invention may also be an application program 42 with communication via API calls with the interfaces 34 and 40 .
  • the program 26 may monitor outgoing packets 51 from the browser 44 and its plug-ins 46 and may provide the browser 44 and its plug-ins 46 with user inputs 36 through interface 34 .
  • the program 26 uses preselected user inputs 53 in a test input set 52 to test an application program 42 , in this case the browser 44 .
  • these pre-selected user inputs 53 will be Web addresses in the form of URLs such as might be provided to the browser 44 by a user using user interface device 38 or the like.
  • these user inputs 53 of the test input set 52 include common web sites expected to be visited by many users and in particular search engines that might trigger a response from the spyware, for example, “www.google.com” being the URL of the Google search engine.
  • the user inputs 53 of the test input set 52 are first applied to a clean version of the application program 42 to be tested, where the clean version of the application program 42 is ideally known to be free from spyware and on a machine that is free from spyware. This process may be conducted on a single computer 20 d, for example when it is first commissioned, or on a separate machine for example computer 20 c being maintained in a pristine state.
  • the user inputs 53 are provided through interface 34 to the browser 44 which produces output packets 51 through interface 40 that are recorded in a standard behavior table 48 by the program 26 .
  • a standard behavior table 48 may be produced to output packets 51 for standard behavior table 48 corresponding to a request for data from the Google web site and a request for an image embedded in the main page data of the accessed Google web site. This process of generating standard behavior table 48 may be done as infrequently as once.
  • each test input set 52 will normally include multiple user inputs 53 for different remote server sites and one or more user inputs 53 for each remote server site.
  • the same user inputs 53 may be applied through network interface 34 ′ to new application program 42 ′ for example being a possibly infected browser 44 ′ on a new computer 20 c or the same browser 44 at a later time on computer 20 d.
  • the browser 44 ′ represents any application program 42 with an unknown state with respect to spyware infection and, in response to the test input set 52 , produces through interface 40 ′ output packets 51 that are collected in an actual behavior table 50 shown in the following Table 2.
  • the actual behavior table 50 may include additional output packets 51 beyond those invoked on the clean machine.
  • those output packets include captured browsing behavior (in the form of URL's) sent to a spyware server and include a URL of the spyware server (not shown in the table).
  • the program 26 uses the data of the standard behavior table 48 and the actual behavior table 50 to compare the corresponding output packets of standard behavior table 48 to the actual behavior table 50 for each entry of the user inputs 53 to identify those packets of actual behavior table 50 that are not standard responses as shown by the corresponding record of standard behavior table 48 .
  • the program 26 individually analyzes each set of nonstandard packets 54 with respect to server addresses 56 to which data will be sent. These server addresses 56 are compared by address matcher 58 to the server names found in the output packets 51 of the standard behavior table 48 . Information indicating a server address 56 is “unknown”, that is, not found in the standard behavior table 48 is sent to a spyware threat assessor 60 as will be described below.
  • the packets of each set of nonstandard packet 54 are also analyzed with respect to the user inputs 53 that evoked the set of nonstandard packets 54 by correlator 62 to determine whether there is a correlation between the user inputs 53 and the data 57 being conveyed by the set of nonstandard packets 54 to a remote site. Such correlation would tend to indicate that private user information is being embedded in an outgoing packet.
  • the results of this comparison are also provided to the spyware threat assessor 60 .
  • the user inputs 53 correlated by the correlator 62 with the data 57 of the set of nonstandard packets 54 may be the most recent user inputs 53 .
  • This short time window of comparison is possible because of a motivation of the designers of some types of spyware to react immediately to user inputs 53 for the delivery of advertisements targeted to the user inputs 53 .
  • the time window of user inputs 53 need not be so limited, and previous user inputs 53 for an arbitrary time window may be considered.
  • Nonstandard packets 54 associated with different user inputs 53 are then compared against each other to identify the longest common subsequence among the multiple set of nonstandard packets 54 .
  • This longest common subsequence is extracted as a potential signature 64 and provided to the spyware threat assessor 60 .
  • the spyware threat assessor 60 operates according to the following Table 3 to output a signature 24 along signature transfer path 28 and/or to notify the user that there is a spyware infection as indicated by warning output 66 depending on the analysis of information from address matcher 58 and correlator 62 .
  • Spyware is most likely and thus a highest score is assigned to situations where the remote server address 56 is unknown and user inputs 53 may be correlated to the data 57 of the packets 54 .
  • a likely rating is provided if there is an unknown server address but the correlation between data 57 and user inputs 53 cannot be easily made.
  • This second case covers spyware that may, for example, encrypt the data it is sending out from an infected machine.
  • spyware infection if the remote server address 56 is recognized.
  • the user may select any score level to trigger a warning output 66 and/or a signature output over signature transfer path 28 depending on a desired level of security.
  • the present invention may be implemented on a single computer 20 and incorporated, for example, directly into an application program 42 , by creating two independent instances of the application, for example, a browser 44 and browser 44 ′.
  • Each of browsers 44 and 44 ′ may receive user inputs 53 from interface 34 applied periodically or when new programs are added by the program 26 as described above.
  • the browsers 44 and 44 ′ may receive actual input from the user via the user interface device 38 or the like as user inputs 53 .
  • Browser 44 differs from browser 44 ′ in that it cannot receive spyware, in this case by not allowing any plug-ins, and because it does not connect to interface 40 . In this way, browser 44 ′ serves to benchmark uninfected browser behavior.
  • Spyware detection program 26 is incorporated into the application program 42 to continuously receive inputs and outputs from both the standard browser 44 and the known clean browser 44 ′ that serve to provide the data of standard behavior table 48 and actual behavior table 50 , respectively. With the possibility of continuous real-time operation, program 26 may provide an immediate warning of spyware behavior through warning output 66 . Over time, multiple novel packets 54 may be collected to extract a signature that may also be forwarded to another machine.
  • some user inputs 36 to a browser 44 will be in the form of a “mouse click” or the like which may not be easily compared to data in the packet 51 being sent out.
  • the user may click on a link in a previously received Web page which produces a packet directed to a Web server identified by that link whose text is extracted by the browser 44 from the Web page.
  • These sorts of user inputs 36 may be captured by the present invention in a specially designed browser which provides the program 26 with access to these derived user inputs 74 transmitted between a browser command processor 76 , which receives the mouse click, and an Internet stack 72 that actually outputs the derived user inputs 74 .
  • program 26 may make use of a pre-selected manual list of URLs or the like for user inputs 53 or may perform a search of binary executable files 78 , presumably including any spyware executables, to find recognizable URLs that may be added to the user inputs 53 to promote spyware type behavior to create dynamic and automatically generated user inputs 53 .
  • the present invention not be limited to the embodiments and illustrations contained herein, but include modified forms of those embodiments including portions of the embodiments and combinations of elements of different embodiments as come within the scope of the following claims.
  • the term “computer” should be considered to refer not only to a unique processor but also to multiple processors sharing execution of a single task in a distributed processing environment. Likewise multiple computers should be interpreted to include multiple processors, or single processors executing multiple simultaneous tasks or sequential tasks, reflecting the understanding of those of ordinary skill in the art that one can arbitrarily divide or combine a computing task among one or more hardware platforms.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Debugging And Monitoring (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Transfer Between Computers (AREA)
US12/515,843 2006-11-29 2007-11-28 System for automatic detection of spyware Abandoned US20100071063A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12/515,843 US20100071063A1 (en) 2006-11-29 2007-11-28 System for automatic detection of spyware

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US86772806P 2006-11-29 2006-11-29
PCT/US2007/085752 WO2008067371A2 (fr) 2006-11-29 2007-11-28 Système de détection automatique de logiciel espion
US12/515,843 US20100071063A1 (en) 2006-11-29 2007-11-28 System for automatic detection of spyware

Publications (1)

Publication Number Publication Date
US20100071063A1 true US20100071063A1 (en) 2010-03-18

Family

ID=39468675

Family Applications (1)

Application Number Title Priority Date Filing Date
US12/515,843 Abandoned US20100071063A1 (en) 2006-11-29 2007-11-28 System for automatic detection of spyware

Country Status (2)

Country Link
US (1) US20100071063A1 (fr)
WO (1) WO2008067371A2 (fr)

Cited By (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090235357A1 (en) * 2008-03-14 2009-09-17 Computer Associates Think, Inc. Method and System for Generating a Malware Sequence File
US20110131652A1 (en) * 2009-05-29 2011-06-02 Autotrader.Com, Inc. Trained predictive services to interdict undesired website accesses
US8180916B1 (en) * 2009-07-17 2012-05-15 Narus, Inc. System and method for identifying network applications based on packet content signatures
US20130247195A1 (en) * 2010-11-09 2013-09-19 Digital Arts Inc. Output control apparatus, computer-readable medium for storing program for output control apparatus, output control method, and output control system
US20130254884A1 (en) * 2009-12-15 2013-09-26 Mcafee, Inc. Systems and methods for behavioral sandboxing
US8566947B1 (en) * 2008-11-18 2013-10-22 Symantec Corporation Method and apparatus for managing an alert level for notifying a user as to threats to a computer
US8584240B1 (en) * 2007-10-03 2013-11-12 Trend Micro Incorporated Community scan for web threat protection
US8707437B1 (en) * 2011-04-18 2014-04-22 Trend Micro Incorporated Techniques for detecting keyloggers in computer systems
US8837485B2 (en) 2012-06-26 2014-09-16 Cisco Technology, Inc. Enabling communication of non-IP device in an IP-based infrastructure
US8904514B2 (en) 2010-04-12 2014-12-02 Hewlett-Packard Development Company, L.P. Implementing a host security service by delegating enforcement to a network device
US20150358344A1 (en) * 2013-01-16 2015-12-10 Light Cyber Ltd. Automated forensics of computer systems using behavioral intelligence
US9270583B2 (en) 2013-03-15 2016-02-23 Cisco Technology, Inc. Controlling distribution and routing from messaging protocol
WO2016190485A1 (fr) * 2015-05-28 2016-12-01 삼성에스디에스 주식회사 Procédé de blocage d'accès non autorisé aux données, et dispositif informatique doté de cette fonction
US9813310B1 (en) * 2011-10-31 2017-11-07 Reality Analytics, Inc. System and method for discriminating nature of communication traffic transmitted through network based on envelope characteristics
US10356106B2 (en) 2011-07-26 2019-07-16 Palo Alto Networks (Israel Analytics) Ltd. Detecting anomaly action within a computer network
US10824727B2 (en) * 2015-04-17 2020-11-03 Easy Solutions Enterprises Corp. Systems and methods for detecting and addressing remote access malware
US10999304B2 (en) 2018-04-11 2021-05-04 Palo Alto Networks (Israel Analytics) Ltd. Bind shell attack detection
US11070569B2 (en) 2019-01-30 2021-07-20 Palo Alto Networks (Israel Analytics) Ltd. Detecting outlier pairs of scanned ports
US11184378B2 (en) 2019-01-30 2021-11-23 Palo Alto Networks (Israel Analytics) Ltd. Scanner probe detection
US11184376B2 (en) 2019-01-30 2021-11-23 Palo Alto Networks (Israel Analytics) Ltd. Port scan detection using destination profiles
US11184377B2 (en) 2019-01-30 2021-11-23 Palo Alto Networks (Israel Analytics) Ltd. Malicious port scan detection using source profiles
US11244048B2 (en) * 2017-03-03 2022-02-08 Nippon Telegraph And Telephone Corporation Attack pattern extraction device, attack pattern extraction method, and attack pattern extraction program
US11316872B2 (en) 2019-01-30 2022-04-26 Palo Alto Networks (Israel Analytics) Ltd. Malicious port scan detection using port profiles
US11509680B2 (en) 2020-09-30 2022-11-22 Palo Alto Networks (Israel Analytics) Ltd. Classification of cyber-alerts into security incidents
US11799880B2 (en) 2022-01-10 2023-10-24 Palo Alto Networks (Israel Analytics) Ltd. Network adaptive alert prioritization system
US12039017B2 (en) 2021-10-20 2024-07-16 Palo Alto Networks (Israel Analytics) Ltd. User entity normalization and association
RU2826864C1 (ru) * 2024-01-10 2024-09-17 федеральное государственное казенное военное образовательное учреждение высшего образования "Краснодарское высшее военное орденов Жукова и Октябрьской Революции Краснознаменное училище имени генерала армии С.М. Штеменко" Министерства обороны Российской Федерации Устройство выявления скрытых каналов в автоматизированных системах
CN119402867A (zh) * 2024-12-31 2025-02-07 北京中睿天下信息技术有限公司 基于WiFi热点流量分析的间谍软件检测方法和装置

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9521083B2 (en) 2014-01-27 2016-12-13 Anue Systems, Inc. Traffic differentiator systems for network devices and related methods
US9832084B2 (en) 2014-01-27 2017-11-28 Keysight Technologies Singapore (Holdings) Pte Ltd Traffic differentiator systems for network devices and related methods including automatic port order determination

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5440723A (en) * 1993-01-19 1995-08-08 International Business Machines Corporation Automatic immune system for computers and computer networks
US20030061513A1 (en) * 2001-09-27 2003-03-27 Guy Tsafnat Method and apparatus for detecting denial-of-service attacks using kernel execution profiles
US20040015719A1 (en) * 2002-07-16 2004-01-22 Dae-Hyung Lee Intelligent security engine and intelligent and integrated security system using the same
US20050018618A1 (en) * 2003-07-25 2005-01-27 Mualem Hezi I. System and method for threat detection and response
US20050044406A1 (en) * 2002-03-29 2005-02-24 Michael Stute Adaptive behavioral intrusion detection systems and methods
US6880087B1 (en) * 1999-10-08 2005-04-12 Cisco Technology, Inc. Binary state machine system and method for REGEX processing of a data stream in an intrusion detection system
US20050080584A1 (en) * 2003-10-14 2005-04-14 Bonilla Carlos A. Automatic software testing
US20050273857A1 (en) * 2004-06-07 2005-12-08 Check Point Software Technologies, Inc. System and Methodology for Intrusion Detection and Prevention

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001092981A2 (fr) * 2000-05-28 2001-12-06 Yaron Mayer Systeme et procede de protection generique generale complete d'ordinateurs contre des programmes pernicieux pouvant voler des informations et/ou provoquer des degats
US20050268112A1 (en) * 2004-05-28 2005-12-01 Microsoft Corporation Managing spyware and unwanted software through auto-start extensibility points

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5440723A (en) * 1993-01-19 1995-08-08 International Business Machines Corporation Automatic immune system for computers and computer networks
US6880087B1 (en) * 1999-10-08 2005-04-12 Cisco Technology, Inc. Binary state machine system and method for REGEX processing of a data stream in an intrusion detection system
US20030061513A1 (en) * 2001-09-27 2003-03-27 Guy Tsafnat Method and apparatus for detecting denial-of-service attacks using kernel execution profiles
US7043756B2 (en) * 2001-09-27 2006-05-09 Mcafee, Inc. Method and apparatus for detecting denial-of-service attacks using kernel execution profiles
US20050044406A1 (en) * 2002-03-29 2005-02-24 Michael Stute Adaptive behavioral intrusion detection systems and methods
US20040015719A1 (en) * 2002-07-16 2004-01-22 Dae-Hyung Lee Intelligent security engine and intelligent and integrated security system using the same
US20050018618A1 (en) * 2003-07-25 2005-01-27 Mualem Hezi I. System and method for threat detection and response
US20050080584A1 (en) * 2003-10-14 2005-04-14 Bonilla Carlos A. Automatic software testing
US20050273857A1 (en) * 2004-06-07 2005-12-08 Check Point Software Technologies, Inc. System and Methodology for Intrusion Detection and Prevention

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
NetSpy:Automatic Generation of Spyware Signatures for NIDS. Wang et al. 2006 IEEE. *
Proof Establsihing date prior to Applicant filing date of 29 Nov. 2006. *
Siren:Catching Evasive Malware(Short Paper). Borders et al. 2006 IEEE Symposium on Security and Privacy. *

Cited By (35)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8584240B1 (en) * 2007-10-03 2013-11-12 Trend Micro Incorporated Community scan for web threat protection
US20090235357A1 (en) * 2008-03-14 2009-09-17 Computer Associates Think, Inc. Method and System for Generating a Malware Sequence File
US8566947B1 (en) * 2008-11-18 2013-10-22 Symantec Corporation Method and apparatus for managing an alert level for notifying a user as to threats to a computer
US20110131652A1 (en) * 2009-05-29 2011-06-02 Autotrader.Com, Inc. Trained predictive services to interdict undesired website accesses
US8180916B1 (en) * 2009-07-17 2012-05-15 Narus, Inc. System and method for identifying network applications based on packet content signatures
US9223963B2 (en) * 2009-12-15 2015-12-29 Mcafee, Inc. Systems and methods for behavioral sandboxing
US20130254884A1 (en) * 2009-12-15 2013-09-26 Mcafee, Inc. Systems and methods for behavioral sandboxing
US8904514B2 (en) 2010-04-12 2014-12-02 Hewlett-Packard Development Company, L.P. Implementing a host security service by delegating enforcement to a network device
US9747437B2 (en) * 2010-11-09 2017-08-29 Digital Arts Inc. Output control apparatus, computer-readable medium for storing program for output control apparatus, output control method, and output control system
US20130247195A1 (en) * 2010-11-09 2013-09-19 Digital Arts Inc. Output control apparatus, computer-readable medium for storing program for output control apparatus, output control method, and output control system
US8707437B1 (en) * 2011-04-18 2014-04-22 Trend Micro Incorporated Techniques for detecting keyloggers in computer systems
US10356106B2 (en) 2011-07-26 2019-07-16 Palo Alto Networks (Israel Analytics) Ltd. Detecting anomaly action within a computer network
US9813310B1 (en) * 2011-10-31 2017-11-07 Reality Analytics, Inc. System and method for discriminating nature of communication traffic transmitted through network based on envelope characteristics
US8837485B2 (en) 2012-06-26 2014-09-16 Cisco Technology, Inc. Enabling communication of non-IP device in an IP-based infrastructure
US9979742B2 (en) 2013-01-16 2018-05-22 Palo Alto Networks (Israel Analytics) Ltd. Identifying anomalous messages
US9979739B2 (en) * 2013-01-16 2018-05-22 Palo Alto Networks (Israel Analytics) Ltd. Automated forensics of computer systems using behavioral intelligence
US20150358344A1 (en) * 2013-01-16 2015-12-10 Light Cyber Ltd. Automated forensics of computer systems using behavioral intelligence
US9270583B2 (en) 2013-03-15 2016-02-23 Cisco Technology, Inc. Controlling distribution and routing from messaging protocol
US10824727B2 (en) * 2015-04-17 2020-11-03 Easy Solutions Enterprises Corp. Systems and methods for detecting and addressing remote access malware
KR101716690B1 (ko) * 2015-05-28 2017-03-15 삼성에스디에스 주식회사 데이터 무단 엑세스 차단 방법 및 그 기능이 구비된 컴퓨팅 장치
WO2016190485A1 (fr) * 2015-05-28 2016-12-01 삼성에스디에스 주식회사 Procédé de blocage d'accès non autorisé aux données, et dispositif informatique doté de cette fonction
US10063558B2 (en) 2015-05-28 2018-08-28 Samsung Sds Co., Ltd. Method for blocking unauthorized data access and computing device with feature of blocking unauthorized data access
KR20160139588A (ko) * 2015-05-28 2016-12-07 삼성에스디에스 주식회사 데이터 무단 엑세스 차단 방법 및 그 기능이 구비된 컴퓨팅 장치
US11244048B2 (en) * 2017-03-03 2022-02-08 Nippon Telegraph And Telephone Corporation Attack pattern extraction device, attack pattern extraction method, and attack pattern extraction program
US10999304B2 (en) 2018-04-11 2021-05-04 Palo Alto Networks (Israel Analytics) Ltd. Bind shell attack detection
US11070569B2 (en) 2019-01-30 2021-07-20 Palo Alto Networks (Israel Analytics) Ltd. Detecting outlier pairs of scanned ports
US11184376B2 (en) 2019-01-30 2021-11-23 Palo Alto Networks (Israel Analytics) Ltd. Port scan detection using destination profiles
US11184377B2 (en) 2019-01-30 2021-11-23 Palo Alto Networks (Israel Analytics) Ltd. Malicious port scan detection using source profiles
US11184378B2 (en) 2019-01-30 2021-11-23 Palo Alto Networks (Israel Analytics) Ltd. Scanner probe detection
US11316872B2 (en) 2019-01-30 2022-04-26 Palo Alto Networks (Israel Analytics) Ltd. Malicious port scan detection using port profiles
US11509680B2 (en) 2020-09-30 2022-11-22 Palo Alto Networks (Israel Analytics) Ltd. Classification of cyber-alerts into security incidents
US12039017B2 (en) 2021-10-20 2024-07-16 Palo Alto Networks (Israel Analytics) Ltd. User entity normalization and association
US11799880B2 (en) 2022-01-10 2023-10-24 Palo Alto Networks (Israel Analytics) Ltd. Network adaptive alert prioritization system
RU2826864C1 (ru) * 2024-01-10 2024-09-17 федеральное государственное казенное военное образовательное учреждение высшего образования "Краснодарское высшее военное орденов Жукова и Октябрьской Революции Краснознаменное училище имени генерала армии С.М. Штеменко" Министерства обороны Российской Федерации Устройство выявления скрытых каналов в автоматизированных системах
CN119402867A (zh) * 2024-12-31 2025-02-07 北京中睿天下信息技术有限公司 基于WiFi热点流量分析的间谍软件检测方法和装置

Also Published As

Publication number Publication date
WO2008067371A3 (fr) 2008-10-23
WO2008067371A2 (fr) 2008-06-05

Similar Documents

Publication Publication Date Title
US20100071063A1 (en) System for automatic detection of spyware
JP5087661B2 (ja) 正常プロセスに偽装挿入された悪性コード検出装置、システム及びその方法
US7870612B2 (en) Antivirus protection system and method for computers
US9712560B2 (en) Web page and web browser protection against malicious injections
US8312536B2 (en) Hygiene-based computer security
US9424424B2 (en) Client based local malware detection method
US8769692B1 (en) System and method for detecting malware by transforming objects and analyzing different views of objects
Wang et al. NetSpy: Automatic generation of spyware signatures for NIDS
US20140053267A1 (en) Method for identifying malicious executables
Singh et al. Keylogger detection and prevention
US9239922B1 (en) Document exploit detection using baseline comparison
CN105491053A (zh) 一种Web恶意代码检测方法及系统
Mallikarajunan et al. Detection of spyware in software using virtual environment
CN105871883A (zh) 基于攻击行为分析的高级持续性威胁检测方法
Solairaj et al. Keyloggers software detection techniques
Kim et al. WebMon: ML-and YARA-based malicious webpage detection
CN116860489A (zh) 用于安全威胁的威胁风险评分的系统和方法
CN104778415A (zh) 一种基于计算机行为的数据防泄露系统及方法
US20250021654A1 (en) Rootkit detection based on system dump files analysis
Bejo et al. Design, analysis and implementation of an advanced keylogger to defend cyber threats
CN106250761B (zh) 一种识别web自动化工具的设备、装置及方法
JP6407184B2 (ja) 攻撃対策判定システム、攻撃対策判定方法及び攻撃対策判定プログラム
US20170374099A1 (en) Attack content analysis program, attack content analysis method, and attack content analysis apparatus
US8418251B1 (en) Detecting malware using cost characteristics
KR100959274B1 (ko) 네트워크 모니터링 정보를 이용한 악성 코드 조기방역 시스템 및 그 방법

Legal Events

Date Code Title Description
AS Assignment

Owner name: WISCONSIN ALUMNI RESEARCH FOUNDATION,WISCONSIN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:JHA, SOMESH;WANG, HAO;GANAPATHY, VINOD;SIGNING DATES FROM 20060126 TO 20070305;REEL/FRAME:022884/0872

AS Assignment

Owner name: ENERGY, UNITED STATES DEPARTMENT OF,DISTRICT OF CO

Free format text: CONFIRMATORY LICENSE;ASSIGNOR:WISCONSIN ALUMNI RESEARCH FOUNDATION;REEL/FRAME:023665/0736

Effective date: 20090723

AS Assignment

Owner name: NAVY, SECRETARY OF THE UNITED STATES OF AMERICA,VI

Free format text: CONFIRMATORY LICENSE;ASSIGNOR:WISCONSIN ALUMNI RESEARCH FOUNCATION;REEL/FRAME:024196/0329

Effective date: 20090723

AS Assignment

Owner name: NAVY, SECRETARY OF THE UNITED STATES OF AMERICA, V

Free format text: CONFIRMATORY LICENSE;ASSIGNOR:WINCONSIN ALUMNI RESEARCH FOUNDATION;REEL/FRAME:024714/0873

Effective date: 20090723

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION